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Custonner wishes to 
access class of 
information from vendor 
web server 




is information 
protected? 



Authenticate customer by 
use of customer ID and 
password 




Was authentication 
successful? 



Identify the group of 
which the customer is a 
member 



Retrieve the group source 
key associated with the 
customer's group 



Encrypt the information 
using the retrieved key 
and send to customer 



Decrypt the intormation at 

the customer using the 
previously provided group 
membership key 



Provide the requested 
information to the 
customer 
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Deny access to the 
requested information 
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Fig.1 



CA920000024US1 

Method and System for Granting Access to 
Information for Electronic Commerce 
2 of 3 



Classify customers into 
N Groups 



Uenne m groups or 
customers to be allowed 

access to protected 
information 



Create M key (Group 
Member/Group Source) 
pairs 



Associate each key pair 
with at least one of the 
defined customer groups 



Encrypt group information 
using the associated 
group source key 



Store all group source 
keys in a secure 
environment 



Make group member keys 
available to authenticated 
members of a group 
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